icedid | addca7f05d7f58f49c256f311aa336a7576ef7520ad3e266f82efbaceac0aef2 | Triage™

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
resource tags

arch:x64arch:x86image:win7-20220414-enlocale:en-usos:windows7-x64system
submitted
16/07/2022, 10:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mVi4x9m3.dll
Size 56KB
Sample220716-m2vfrabda5
SHA256 cda6e3247a765c9e4613cfd71e0ee0300abe5a3d68cd4fe0c9a76acb7a945be2
MD5 7007b534a839143a3f2456d09fe4fc3f
SHA1 5e492b0a94823e488271a94f03cf7b4c4a880967
SHA512 9a0128cfaed5b7fec1c90348ab146fbe317f878f0c361778e47e31c24cdf7cfda8d765d8e5667e73ee20a411c1c8f25cc5cb9b2c272f415006d1d088f1a5e352
MD5 SHA1 SHA512

Score

10^/10

icedid 294489237 banker loader suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

294489237

C2

alldogsedag.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	880	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
880	rundll32.exe
880	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mVi4x9m3.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/880-54-0x0000000180000000-0x0000000180009000-memory.dmp

Download